Bitbucket pipeline connection to RDS

[Svetlozar Petkov]

Hello marvelous community!

We want to connect the bitbucket pipeline to an RDS testing database instance in AWS to run unit tests during runtime of the pipeline however the RDS is private and does not have a public address. We are using php. Is there a workaround to make this connection possible and not make the RDS public ? We have an IAM pipeline user which the pipeline logs into to download docker images from ECR, but I dont see a role that might help with this.

[Theodora Boudale]

Hi Svetlozar,

As far as I can see in Amazon RDS documentation, you could use IAM to access RDS:

• https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAM.html

On the following Bitbucket documentation page, you will find steps on how to use Bitbucket Pipelines OpenID Connect on AWS:

• https://support.atlassian.com/bitbucket-cloud/docs/deploy-on-aws-using-bitbucket-pipelines-openid-connect/

There are sections on how to configure Bitbucket Pipelines as a Web Identity Provider on AWS, how to create an Identity and Access Management (IAM) role and how to configure the Pipelines build to assume the created role.

Kind regards,
Theodora

[Ezbon Jacob]

@Theodora Boudale So the links you shared are more about authenticating to the AWS RDS instance without a username and password.

But the problem I believe @Svetlozar Petkov is pointing out is how do we setup a network layer connection to a private subnet from bitbucket runners.

I believe the only option I can see is that you need to run your own self hosted runner in your account if bitbucket has that capability. Or create a private ec2 instance in your account and then use ssm to login into that instance and then run your commands from that ec2 instance

[Theodora Boudale]

You're absolutely right, my mistake for not taking into account the network layer. Pipelines builds that run on Atlassian's infrastructure can connect to other servers over the public internet. If there is no way to open access to the IP addresses used by Pipelines, then the options you mentioned make sense. Bitbucket does support self-hosted runners for your Pipelines builds:

• https://support.atlassian.com/bitbucket-cloud/docs/runners/

Please keep in mind that a self-hosted runner will need to have outbound access to bitbucket.org for the builds to work. The IP addresses used by runners are documented here:

• https://support.atlassian.com/bitbucket-cloud/docs/ip-addresses-for-runners-behind-corporate-firewalls/